The Full Arch by Dr SkotsAI for dentists, from a dentist
Patient data

Patient data: the rules

Patient details never go into AI by mistake.

Remove names and anything that could identify someone first. For regular work about real patients, use a business plan your practice has a data agreement for. Nothing we make ever stores, posts or sends patient details.

Download the one page checklist (PDF)The front desk card (PDF)

Free to print, no sign up. For you, your team and your front desk.

The one rule, in four habits

Four habits

  1. 1Settings firstTraining off (“Help improve our AI models”), and memory and chat sharing used with care.
  2. 2Anonymise in five stepsBefore you paste, then run the second check.
  3. 3Right plan for the jobMarketing on any plan. Regular patient work only on a business plan with a data agreement. In the US, a signed business associate agreement first.
  4. 4Never confirm someone is a patientNot in review replies, posts or ads.
The checklist

Before you use AI with anything about patients*

One page. Ten minutes. Then a habit.

01Settings

1. Change these settings first (5 minutes)

  • Claude: Settings › Privacy. Turn off Help improve our AI models. With it off, Anthropic keeps chats for 30 days and doesn’t train on them (Free, Pro and Max plans). Team and Enterprise are never used for training.
  • ChatGPT: Settings › Data controls. Turn off Improve the model for everyone.
  • Don’t share a link to a chat that held practice work. A shared project is visible to everyone in it.
Claude's Settings, Privacy page: the switch Help improve our AI models, ringed, to turn off.
Claude, Settings › Privacy. Checked 28 October 2026.
02Connections

2. What to connect, and what not

Fine to connect

  • A marketing inbox, not the one patients write to
  • A Google Drive folder with marketing photos only
  • Google Business Profile, Search Console and Analytics
  • Your Facebook, Instagram and Google ad accounts, to read campaigns
  • Your website (WordPress or Wix) and Canva
  • Apify, for public Instagram accounts

Don’t connect

  • The practice inbox where patients write, unless you’re on a business plan your practice has a data agreement for
  • Your practice software or patient records
  • Your whole Drive, if clinical folders are in it
  • WhatsApp chats with patients
  • Contact lists of patients, to Claude or to any ad platform
03Never paste

3. Never paste

  • Names.
  • Dates of birth.
  • Addresses, phone numbers, emails.
  • Record, health or insurance ID numbers.
  • Appointment dates tied to a person.
  • X-rays or clinical photos with a face or a name.
  • Screenshots of your practice software.
  • A full complaint letter.
  • A transcript with names in it.
04Anonymise

4. Anonymise in five steps

  1. 1

    Swap names for [PATIENT], [DENTIST], [NURSE].

  2. 2

    Take out contact details and any ID numbers.

  3. 3

    Swap exact dates for “last spring” or “two weeks ago”.

  4. 4

    Take out rare details that point to one person: their job, their street, an unusual story.

  5. 5

    Paste, then ask: “Is there anything in this that could identify a person?” Fix what it finds before you use the reply.

An invented clinical note before and after: the name, date of birth, health number, date, job and holiday struck out; underneath, the short clinical note that is left.
An invented note, not a real patient. Chapter 5 of the ebook has the second check prompt.
05In public

5. In public

  • Never confirm that someone is a patient: not in a review reply, a post or an ad.
  • Before and afters, and reviews with names: only with written consent, kept on file.
06Plans

6. Which plan for which job

  • Marketing (posts, reels, ads, your website, review replies with no details): any plan, with training off.
  • Letters, complaints or transcripts about real patients: anonymised first, and on a business plan your practice has accepted the data terms for: Claude Team (from 2 seats) or Enterprise.
  • US practices with protected health information: only Claude Enterprise with HIPAA turned on and the business associate agreement accepted. Team, Pro and Max can’t sign one.

Claude Team needs at least 2 seats. A standard seat is $25 a month, or $20 a month billed yearly (US prices, before tax, checked 29 October 2026).

07If it slips

7. If something slips

  1. 1Delete the chat.
  2. 2Tell your practice manager or data lead.
  3. 3Note it in your incident log.
  4. 4Follow your country’s breach rules.
Download the one page checklist (PDF)The front desk card (PDF)
Transcripts and recordings

Transcripts and recordings

  • Consultation transcripts: anonymised transcripts only, on a business plan your practice has a data agreement for (Claude Team or Enterprise).
  • Recording a consultation needs the patient’s documented consent, a practice owned device, and deleting the audio once you’ve used it.
  • In the US, a transcript with protected health information goes only into Claude Enterprise with HIPAA turned on and the business associate agreement accepted.
By country

Where you practise

WhereWhat it means for AI
UKHealth information is special category data under UK GDPR. Before any of it goes into a tool, your practice needs a legal basis, a data processing agreement with the company behind the tool, and a line in your privacy notice. Your GDC standards on confidentiality apply just the same. For the detail: the BDA and the ICO.
USProtected health information falls under HIPAA. It goes only into Claude Enterprise with HIPAA turned on and the business associate agreement (BAA) accepted. Team, Pro and Max can’t sign one.
Everywhere elseCheck your own data protection law and your professional body’s guidance before anything about a patient goes into an AI tool.
What we never see

What we never see

  • We never see your chats, your accounts or your data.
  • The flows run in your own Claude, under your own plan. Your chats are processed by Anthropic under your plan’s terms, not by us.
  • The writing flows need no patient details. If you paste some in, they ask you to take them out, but that is a safety net, not a guarantee, so check before you paste.
The small print

* Written for practices in the UK and the US. Elsewhere, check your own data protection law and your professional body’s guidance. This is not legal advice. Checked 29 October 2026.

We are dentists, not lawyers. Your practice is responsible for its own data. Questions? fullarch@drskots.com

Patient data: the rules · The Full Arch